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Network General Corporation 
delivers intelligent and integrated 
network analysis solutions that lead 
the industry. These systems and 
applications help organizations 
optimize the performance of 
heterogeneous LANs, internetworks, 


and enterprise network environments. 


Since 1986, the company has 
engineered the industry’s award- 
winning Protocol Interpretation, 
standards-based RMON, and 
artificial intelligence Expert Analysis 
applications. 


Delivering important milestones in 
true multivendor interoperability and 
cooperation, Network General’s 


Sniffer technology is the de facto 
industry standard. The company 
maintains qualified sales, service, 
and support organizations to help 
customers proactively plan their 
networks, optimize performance, 
and achieve maximum network 
availability. With installations in 
90% of Fortune 100 companies and 
over 3,500 customers worldwide, 
Network General is the network 
analysis market share leader. 


For more information about 
Network General’s comprehensive 
products and services, please call 
1-800-SNIFFER (1-800-764-3337). 
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The Foundation for Intelligent This paper explores the following: 
Network Management * What is Expert Analysis? 


Network General Corporation leads the industry, » ADEE Sales to Nebo Emeblns 


delivering intelligent network analysis and monitoring ¢ The Benefits of Expert Analysis 
solutions that address evolving trends in computing » Network General Expert Analysis Products 
technology. As businesses increasingly rely on 

client/server networks to maximize their competitive 

edge, Network General offers a family of products and 

services that help solve network problems and maximize 


network performance. 


Network General pioneered Expert Analysis 
technology in 1991. By placing the intelligence of a 
network expert into the hands of network professionals, 
Expert Analysis continues to revolutionize the process 
of network design, implementation, and management. 
Expert Analysis forms the foundation for intelligent 
systems management and helps: 


* Improve network performance and decrease 
downtime 


* Identify problems proactively and speed the 
problem resolution process 


* Increase productivity by providing answers, not 
just data 


¢ Reduce network operating costs and leverage 
existing hardware 
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What Is Expert Analysis 


Network General developed Expert Analysis 
technology to meet the challenges of managing 


increasingly complex and constantly changing networks. 


This innovative, artificial intelligence network analysis 
software is based on theoretical and prototype work 
done at Stanford University’, the University of 
Massachusetts’, and Nippon Telephone and Telegraph 
(NTT)’. Network General spent several years 
evaluating, modifying, and adapting various artificial 
intelligence methodologies to create its industry-leading 
Expert Analysis technology. 


How Does Expert Analysis Work? 


Today, Expert Analysis captures packets as they 
travel across the network. These packets are forwarded 
to a set of real-time protocol decode modules which 
then extract information or “network objects” from each 
packet. These objects store critical information such as 
the IP address, connection number, or a set of file 
transfers between two stations. The objects contain 
packet information about all seven OSI layers. 


Objects are the key (see Figure 1, page 3). With 
Expert Analysis, the system stores the most important 
information as objects and then uses this object-based 
information to identify network problems. Object- 
oriented methods provide both generalized information 
handling and the ability to adapt to topology- or 
protocol-specific issues as required. 
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At the same time, Expert Analysis creates a logical 
view of the network by determining which devices are 
communicating with which other devices. The network 
objects are stored in a “Blackboard Knowledge Base’ 
and are constantly updated as new information is 
extracted by the protocol decode modules. 


Expert Analysis technology also includes Knowledge 
Sources that incorporate years of network management 
experience into the software. Each separate Knowledge 
Source constantly posts information to the Blackboard 
and examines it to identify network problems. When a 
problem is identified, the Knowledge Source generates a 
symptom and/or diagnosis on the screen for you to act 
upon. 


Moreover, A Knowledge Source can detect a class 
of problems across many network types by looking 
for generalized types of problems across protocols. 
This provides very powerful problem detection in a 
multivendor, mulitprotocol environment. It also makes 
Sniffer Expert Analysis technology easily extensible to 
additional network problems. In addition to providing 
real-time problem identification at all seven OSI layers, 
Expert Analysis also provides explanations to possible 
causes for each problem discovered. 


Hitson, Bruce L. “Knowledge-Based Monitoring and Control of Distributed Systems,” Technical Report Number CSL-TR-414, Stanford University, 


2 Lesser, V., et al. “A High-Level Simulation Testbed for Cooperative Distributed Problem-Solving,” Computer and Information Science, 


University of Massachusetts at Amherst, March, 1981. 


3 Sugawara, Toshiharu. “A Cooperative LAN Diagnostic and Observation Expert System,” [EEE Proceedings of the IEEE Phoenix International Conference 


on Computers and Communication, 1990, pp. 667-674. 


4 Corkill, Daniel. “Blackboard Systems,” A/ Expert, September, 1991, pp. 41-47. 
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Figure 1: Expert Sniffer technology extracts network objects from each packet to identify network problems 
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Revolutionary Management Technology 


Expert Analysis technology puts years of network 
troubleshooting experience into your hands. Unlike 
other network troubleshooting tools, Network General 
Sniffer products use the artificial intelligence 
capabilities of Expert Analysis to automatically identify 
network problems. This industry-leading technology 
allows you to take advantage of the collective expertise 
amassed through years of Network General’s focused 
network analysis efforts. 


Expert Analysis technology solves many common 
network problems at all seven layers of the OSI model. 
To understand how, think of a network analyzer as an 
X-ray machine. An X-ray shows the bone structure of 
the patient, but a specialized technician is still required 


to interpret the findings, and a doctor is needed to make 
the final diagnosis. 


Expert Analysis combines the roles of the X-ray 
machine, technician, and doctor into one. Expert 
Analysis creates a system that identifies, interprets, and 
diagnoses network problems and performance 
irregularities. Because Expert Analysis does this work 
automatically, you can quickly correct existing prob- 
lems, proactively identify potential problems, and 
maximize network performance. 


Expert Analysis helps automate the process of 
solving network problems in high-performance 
environments. Figures 2 and 3 depict a typical 
problem-solving scenario using Protocol Interpretation 
and Expert Analysis applications. 
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Figure 2: Protocol Interpretation Application 


This screen shows a Novell NetWare client reading a file from the server. By examining 
the read byte sizes and calculating the time between packets, you can determine that the 
transaction throughput is low. 
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CAPTURING Application Symptom Detai 100: 00: 48 
Protocol: XNS-PEP. Novell 
— Net Station 1 (local): Net Station 2 (local) 
“Appl. ID | Conn. ID: 81 
Net name Acct Jud 
Net addr. | H:000000000001 H: 050701081863 
Subnet 00100008 00000009 
DLC name | Server 6 Client 5 
DLC addr. | 00001B100C5E 020701081863 


Symptom: Low file transfer throughput 


Average File Performance 
s Station 1 inter-frame-time: 10ms 
Packet data length: 160 bytes Station 2 inter-frame-time: 38ms 


Throughput: 3 Kb/. 


Symptoms: 35 First at: 9/10 08:30:06, last at: 9/10 08:30:06 
Last problem: Low throughput = 11 kbps 
Press PgDn for statistics, ESC for summary info 


Figure 3: Expert Sniffer Technology 


Expert Analysis observes the file transfer shown previously in Figure 2 and 
automatically determines that the file throughput is low. No detailed calculations are 
required by the network manager. In addition, Expert Analysis discovers a wealth of 
Statistical information (such as the network names of the client and server), enabling 
faster pinpointing of problem areas. The statistical information supports the Expert 
Analysis diagnosis of low throughput. Using this Expert Analysis information, you can 
focus your troubleshooting efforts for faster problem resolution. 
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Expert Solutions to Network 
Problems 


Expert Analysis provides you with three types of 
information: 


¢ Symptoms 
¢ Diagnoses 


¢ Explanations 


In Figures 4 through 6, Expert Analysis 


automatically identifies a router configuration problem. 


Figure 4 explains the problem. Figure 5 draws a 
context-sensitive network diagram showing how a 
router is used for communication between two stations 
on the same local network. Figure 6 offers possible 
causes of the problem and provides suggestions for 
corrective action. 


XPERT EXPLAI 
Connection: Network Time 


Diagnosis: Local router 


Symptoms 

As traffic passes over individual LAN and 
internetwork segments, Expert Analysis examines the 
network for unusual activities called symptoms. By 
itself, a symptom is not necessarily a fault, but it could 
indicate a potential network problem. Symptoms are 
events you might want to investigate before they 
become serious problems. For example, a single file 
retransmission is not necessarily a problem because the 
network continues to function and users continue to 
perform their work. However, when file retransmissions 
happen multiple times in a row on the same file, or 
retransmit repeatedly over a few seconds, network 
performance may suffer. 


(129.89.7.14] <---> [128.124.238.111] 


Two DLC stations on the same segnent are communicating via a router. 


Packets are being transmitted via the router rather than directly from one 
DLC station to the other. 


Figure 4: Expert Analysis identifies the symptoms, diagnoses problems, and provides explanations 


automatically 
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Diagnoses (such as excessive file retransmissions) or where there 

A diagnosis highlights something that, in the is a Single instance of a major network problem (such 
judgment of the Expert Analysis software, you should as a duplicate network address). Diagnoses highlight 
act on. Expert Analysis automatically provides solutions to problems that may impact network 
diagnoses when a symptom repeats itself frequently performance. 


Network ‘stations 


DECnet1 


router 
DECnet348CC7 


Figure 5; Expert Analysis provides diagrams that illustrate and explain network problems 
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Explanations + Performance Bottlenecks 
For each symptom and diagnosis, Expert Analysis Expert Analysis helps detect multiple file 


: : a retransmissions, non-r msive ions, 
creates a network-specific explanation of the condition SIENAMUSSIONS, ROM-IMSPOOSIVe SIAUODS, And SLOW 


and automatically recommends possible solutions. servers that can cause performance bottlenecks. 


Based on the symptoms and diagnoses, Expert Analysis 

automatically offers explanations that recommend = Bread yes nos 

possible corrective action. Expert Analysis recognizes non-standard protocol 
activity such as missing acknowledgments and 


Expert Analysis delivers symptoms, diagnoses, and window size problems, and suggests solutions for 


explanations for a wide variety of network problems protocol problems. 
including: 
¢ Physical-Layer Problems 


* Internetworking Problems Expert Analysis speeds the process of identifying 


Expert Analysis pinpoints duplicate network and solving Ethernet and token ring lower-layer 
addresses. The nodes involved are identified problems, including congestion and ring beaconing. 
automatically. Router misconfigurations are also 
highlighted to help minimize WAN bandwidth 
charges. 


Possible causes? 


1. The router table may be improperly configured. If this is the case, 
reconfigure the router table so that the stations can communicate with 
each other directly. 


. The router may be used for security purposes, to control access to 
particular parts of the network. 


. The router may be performing gateway type functions, such as protocol 
translation at the application level. 


. A device that is new to the network is sending frames through a router 
because it has not uet become aware of the direct route to a local 
station. 


Figure 6: Expert Analysis offers explanations about possible causes of network problems 
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The Benefits of Expert Analysis 


In order to effectively solve network problems and 
improve network performance, Network General’s 
Expert Analysis technology dissects and analyzes 
real-time data moving at high speeds across the network 
at all seven OSI layers. The benefits of this intelligent 
network analysis solution include: 


Proactive Network Management 

Expert Analysis keeps your network operative by 
automatically forewarmning you of problems before they 
affect end users. Expert Analysis pinpoints network 
problems at all seven OSI layers and suggests solutions 
in real time to help return your network to peak 
performance levels. With the Network General® 
Reporter application, you can use Expert Analysis data 
to generate real-time reports. Use these reports to 
forecast application requirements and justify equipment 
purchases so your network continues to operate 
efficiently. 


Automatic Problem Identification 


Expert Analysis gets to the underlying cause of 
problems on Ethernet and token ring LAN segments, as 
well as bridged and routed internetworks. From the 
physical through the application layers, Expert Analysis 
technology automatically provides detailed, real-time 
diagnoses and English explanations of many common 
network problems while traffic is moving across the 
network. This fast identification and analysis of 
problems translates directly into increased performance 
and reduced network downtime. 


Optimized Network Investments 


Understanding a network’s configuration is critical to 
optimizing your investment in network components. 
Expert Analysis automatically learns a network’s logical 
configuration and constantly updates it in real time. 
First, Expert Analysis learns station names, routing 
paths, and configuration information. Then, Expert 
Analysis applies this information automatically to 
pinpoint network inefficiencies. Using Expert Analysis 
information, you can create in-depth reports with the 
Network General Reporter application. Use this 
information to track your network’s performance, 
analyze historical trends, and configure your network 
for peak performance. 
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Network General Expert 
Analysis Products 


Network General engineered the industry’s premier 
Expert Analysis software to help you resolve problems 
on mission-critical segments more quickly. Today, our 
Sniffer® systems and tools continue to address your 
network management needs with quality analysis 
solutions that provide complete coverage of your 
network segments. Choose from a wide range of 
Network General products that offer scalable and 
integrated solutions to keep your network up and 
running efficiently. 


Distributed Sniffer System® 

The Distributed Sniffer System (DSS) is a 
comprehensive network analysis and monitoring system 
that delivers Expert Analysis technology and Remote 
Monitoring (RMON) to quickly resolve distributed 
network problems from a central location. Using DSS, 
you can also troubleshoot LAN communications over 
internetworks, as well as Ethernet and token ring 
segments. 


For organizations that rely on client/server 
applications running over a web of LANs and WANs, 
DSS aids in baselining, trend analysis, performance 
tuning, and problem resolution from a single site. 
Network General developed DSS with a range of 
monitoring and analysis components for managing 
distributed client/server networks from end to end. 


Network General continues to enhance DSS to 
broaden Expert Analysis coverage for your distributed 
network. In addition to integrating Expert Analysis with 
RMON, DSS integrates with popular network 
management systems. Today, DSS provides Expert 
Analysis capabilities in the most popular UNIX 
environments and on the most powerful network man- 
agement systems in the industry such as HP OpenView, 
IBM NetView, and SunNet Manager. Consequently, 
DSS enables you to optimize your existing hardware 
investments and manage your distributed networks from 
a central location. 


Expert Sniffer® Network Analyzer 


By putting years of network troubleshooting 
experience into your hands, Expert Sniffer Network 
Analyzers deliver portable, practical, problem-solving 
solutions. Today, an expanded line of Sniffer products 
connects to more physical topologies and interprets 
more protocols than any other portable analyzer 
available. 


Expert Sniffer Network Analyzers for Ethernet, 
token ring, internetwork, and FDDI topologies use an 
intuitive menu and command system. Designed to run 
on industry standard PCs, rather than expensive 
proprietary hardware, Expert Sniffer Network Analyzers 
are ready to solve network problems right out of the 
box. 


Notebook Sniffer® Analyzer 

To make troubleshooting easier for field service 
personnel, Network General introduced a new 
generation of flexible network analysis solutions that 
utilize Expert Analysis technology. Notebook Sniffer 
Analyzers use the Personal Computer Memory Card 
International Association (PCMCIA) standard and run 
on a wide variety of notebook PC platforms. 


Expert Sniffer® Internetwork Analyzer 


With this portable tool, you can directly manage 
bandwidth costs. By providing a comprehensive view 
of communications traveling over internetwork links, 
Expert Sniffer Internetwork Analyzers pinpoint network 
bottlenecks and offer recommendations to improve 
bandwidth efficiency, application throughput, and 
response times. 


The Expert Sniffer Internetwork Analyzer resolves 
complex internetwork issues encountered when running 
LAN protocols over bridged and routed networks. 
Expert Analysis displays Expert-level information about 
LAN protocols running over leased line, frame relay, 
and X.25 internetworks. 


Network General protects your investment in 
Distributed Sniffer System components and portable 
Expert Sniffer Network Analyzers. These products will 
continue to support future enhancements to Expert 
Analysis technology by means of a simple software 
upgrade. 
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Conclusion 

Network General’s industry-leading Expert Analysis 
technology forms an intelligent base for developing 
powerful network analysis applications in multivendor, 
multiprotocol environments. Expert Analysis revolution- 
izes the way you manage networks by: 


* Proactively finding problems to maximize 
network performance 

* Preventing costly network downtime 

* Shortening time to problem resolution 


* Increasing productivity by providing answers, 
not just data 

* Reducing network operating costs through more 
efficient planning and higher network 
performance 


To address the challenge of increasing network 
complexity, Network General continuously 
incorporates new problem-solving intelligence into 
Expert Analysis. Ongoing enhancements to Expert 
Analysis technology offer insurance that you can 
address new problems in your network environments. 
Pioneering the next generation of intelligent network 
management, Expert Analysis will address 
multisegment troubleshooting where correlated 
problem identification is crucial. 


By combining our network expertise with the 
experience of our customers and other industry 
leaders, Network General consistently develops 
state-of-the-art solutions. Key industry influentials 
acknowledge Network General’s leadership in the 
network analysis market. With this commitment to 
enhance, extend, and build on existing Expert Analysis 
technology, you can rely on Network General’s 
cumulative knowledge base to help manage growing and 
changing networks. 


Please contact your Network General 
sales representative or call 
1-800-Sniffer (1-800-764-3337) 
for further information on the industry’s 


leading Expert Analysis technology. 


Thank you for your interest in 
Network General. 
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